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Abstract. We propose two algorithms to factor numbers using Gauss sums and 
i-C I entanglement: (i) in a Shor-like algorithm we encode the standard Gauss sum in one 

of two entangled states and (ii) in an interference algorithm we create a superposition 
of Gauss sums in the probability amplitudes of two entangled states. These schemes are 
■ rather efhcient provided that there exists a fast algorithm that can detect a period of 

^ ■ a function hidden in its zeros. 



PACS numbers: Valid PACS appear here 

■ 1. Introduction 

Q ! Gauss sums, that are sums whose phases depend quadratically on the summation index, 

CN '• have periodicity properties that make them ideal tools to factor numbers. The crucial 

role of periodicity in the celebrated Shor algorithm has recently been identified and 
summarized by N. D. Mermin [1] in the statement Quantum mechanics is connected to 
^ I factoring through periodicity . . . and a quantum computer provides an extremely efficient 

'. way to find periods" . 

In a series of papers [2^,^ we have analyzed the possibilities of Gauss sums for 
factorization offered by their periodicity properties. Although our considerations were 
confirmed by numerous experiments [1] the schemes proposed so far scale exponentially 
since they do not envolve entanglement. In the present article we propose and investigate 
two algorithms which connect [5l|6] Gauss sum factorization with entanglement. 

Throughout our article, we consider two interacting quantum systems and describe 
them by two complete sets of states with discrete eigenvalues. We pursue two 
approaches: (i) we encode the absolute value of the standard Gauss sum in one of the 
two quantum states, and (ii) we create an interference of Gauss sums in the probability 
amplitudes of a quantum state. 

Since our first algorithm is inspired by the one of Shor, we replace the modular 
exponentiation / used by Shor by a function g defined by the standard Gauss sum. 
However, there is a crucial difference between / and g: whereas every value of / is 
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assumed in a period only once pj, the function g takes on the same value several times. 
In this case, the periodicity is stored in the zeros of a probability distribution. Moreover, 
this method is based on a very specific initial state which is unfortunately hard to realize. 
In order to avoid these complications, we encode in the second approach the Gauss sum 
in the probability amplitudes of the state rather than in the state itself. In this way we 
obtain a superposition of Gauss sums. 

Our article is organized as followes: in Sec. |2] we combine the Shor algorithm 
with Gauss sum factorization by replacing the function / by the appropriately standard 
Gauss sum g. The discussion of this new algorithm leads in Sec. |3]to the idea of using 
entanglement to estimate the Gauss sum Wn^^ , which we then apply to factor numbers. 
We conclude in Sec. lUby summarizing our results and presenting an outlook. 

2. Shor algorithm with Gauss sum 

In this section, we discuss a generalization of the Shor algorithm where the absolute 
value of an appropriately normalized standard Gauss sum replaces the modular 
exponentiation. For this purpose, we first analyze the periodicity properties of this 
function and then suggest an algorithm similar to Shor. Next, we investigate the 
factorization properties depending on the measurement outcome of the second system. 
We conclude with a brief discussion of the similarities and differences between the 
original Shor algorithm and our alternative proposal. 

2.1. Periodicity properties of normalized standard Gauss sum 

The Shor algorithm [7] contains two crucial ingredients: (i) the mathematical property 
that the function 



exhibits a period r, that is f{i,N) = f{i + r,N), and (ii) the quantum mechanical 
property that the Quantum Fourier Transform (QFT) is able to find the period of a 
function in an efficient way. 

However, we now show that it is possible to construct an algorithm similar to the 
one by Shor, by using the periods of other functions which also contain information 
about the factors of a given number A^. An example is the function 



f{i,N) = mod AT 



(1) 



g{i,N)^hG{i,N)\' 



(2) 



expressed in terms of the standard Gauss sum [8l[9] 




N-l 



(3) 



m=0 



The properties of G provide us with the explicit form 

g = gcd{e,N) 



(4) 
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that is the function g is determined by the greatest common divisor (gcd) of and i. 

We now analyze the periodicity properties of g for the two cases: (i) consists of 
two, or (ii) more than two prime factors. 




Figure 1. Periodicity properties of the function g = g{i,N) defined by ([2]) for the 
example iV = 35 = 5 • 7. This function contains one perfect period r = 35, given by 
the number = 35, and two imperfect periods f — 5,7 determined by the factors of 
N. At multiples fc of a factor p = 5 or 7 the function g is given by the factor itself. 
However, if £ is also a multiple of = 35 as marked by rectangles, the periodicity 
relation g{£, N) = g{£ + f, N) does not hold anymore. 



2.1.1. N consists of two prime factors If contains only the two prime factors p and 
g, the explicit value of the function g = g{£, N) is given by 
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(5) 



As a consequence, g shows one perfect period r = N, where the identity g{i, N) = 
g{i + r,N) is valid for all arguments i, and two imperfect periods f = p,q, where 
g{i, N) = g{i + r, N) is valid for allmost all arguments i. This behavior of g is displayed 
in figured] for the example N = 35. Indeed, every argument i of g which is a multiple 
of a factor p leads to a value of g equal to this factor. However, for arguments i = k ■ N 
which are also multiples of the function g yields g{k ■ N, N) = N, and therefore the 
periodicity relation g{i, N) = g{i + k ■ p,N) does not hold true for these arguments. 

Furthermore, the imperfect periods given by the factors of A^ interrupt each other. 
For example, all arguments £ which are multiples of q do not satisfy the periodicity 
relation for the imperfect period r = p because the greatest common divisor of i = sq 
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and N is q {if s ^ k ■ p) and therefore 
g{s ■q,N) = q. 



(6) 



However, the argument £ = s ■ q + k ■ p shares in general no factor with N. Therefore, 
we obtain 



g{s ■ q + k ■ p, N) = 1. 



(7) 
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Figure 2. For numbers with more tlian two factors such as iV = 105 = 3 • 5 • 7, 
tliere exist several imperfections of the periodic behavior of g which stands out most 
clearly for multiples of factors such as p = 5. Whenever the argument ^ is a multiple 
of a product of two or more factors, such as ^ = 30 = 2 • 3 • 5, the signal is enhanced, 
and the periodicity relation is not valid at these arguments. 



2.1.2. N consists of three or more prime factors If consists of more than two prime 
factors, such as = 105 = 3 ■ 5 ■ 7, then the signal g is more complicated, as shown in 
figure [21 Here, the imperfect periodicity at multiples of factors is interrupted for every 
which shares more than one prime factor with A^, such as £ = 30 = 2 ■ 3 ■ 5. However, 
these arguments £ form a new imperfect period given by gcd(£, A^) which in our example 
reads gcd(30, 105) = 15. This new imperfect period again contains information about 
the factors of A^. 

In the following sections, we will not distinguish between perfect periods and 
imperfect periods anymore, since the imperfection of the imperfect periods do not 
influence our proposed algorithms, as long as g{i,N) = g{i + r,N) is valid for most 
arguments i. 



2.2. Outline of algorithm 



In the present section we introduce an algorithm which combines Gauss sums and 
entanglement and is constructed in complete analogy to the Shor algorithm. For the 
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sake of simplicity we concentrate on numbers with only two prime factors p and q. 
Similar to Shor, we start with the entangled state 

2Q-1 

\^)^^^^ Y.\i)Mi,N))s, (8) 



2Q 

of two systems A and B. However, in contrast to Shor we encode in system B the 
function g defined by ([2]) rather than / given by ([T]). The dimension of system A is 
chosen to be 2^ because we want to realize this system with qbits. We will give a 
condition for the magnitude of Q in the next section. 

In the second step, we perform a measurement on system B. For an integer N = p-q 
consisting only of the two prime factors p and q there exist three distinct measurement 
outcomes: 

(i) the number to be factored, that is g{i, N) = N, 

(ii) a factor of A^, that is g{i, N) = p 01 g{i, N) = q, 

(iii) unity, that is g{i,N) = 1. 

In case (i), the state of system A after the measurement of B reads 

Mjv-l 

|^(A^))^^^(A^) J2 \k-N)A (9) 
fe=0 

where the normalization constant A/"^^-* = M^^'^ is given by M^r = and [x] 

denotes the smallest integer which is larger than x. 

The state \'^^^^) a shows a periodicity with period A^, which does not help us to 
factor the number A^. Therefore, we will have to repeat the first two steps of our 
algorithm until the measurement outcome differs from A^. Fortunately, case (i) occurs 
only with the probability V^^^ 1/N and is therefore not very likely. 

In case (ii), system A is in a superposition of all number states \t)Ai which are 
multiples of the factor p of A^, but not of A^ itself giving rise to 

(Mp-l Mm-1 \ 

\k-p)A- (10) 

where Af'^P'> = (Mp - M^)'^/^ with Mp = [2«/p]. 

In this state, as depicted in figure [3] for the example A^ = 91 and p = 7, only 
multiples of p appear with a non-zero probability 

P^/\i;N)^\A{p\i^^P'>)Af (11) 
which leads to a clearly visible periodicity. However, the periodicity is imperfect at 
arguments £ = k ■ N, which are multiples of A^. We emphasize that this case occurs 
with the probability P^'* ~ 1/p — 1/A^ and is therefore more likely than (i). 

In the third case, system A contains all numbers i which are not multiples of one 
of the factors of A^. As a consequence, the state reads 

(2Q-I Mp-l Mq-l Mjv-l \ 

J2 \^)a- Y1 I^-p)^ - E \k-q)A+ Yl \k-N)A] (12) 
e=0 k=0 k=0 k=0 ) 
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Figure 3. Probability distribution P^^\i;91) to find |^)^ in the state \iIj^'^^)a for tlie 
example = 91 = 7 • 13 and p = 7 in the range 1 < £ < 200. The probability is 
non- vanishing only for multiples of 7. However, multiples of 7 which are also multiples 
of iV = 91 have a vanishing probability. As a consequence, the period of \'iIj^'^'')a is 
imperfect. 



with Ar(i) = (2« - Mp- Mg + M^)-^/'^ and = [2^/^]. Since all multiples of 
are contained in the second as well as in the third sum we have subtracted them twice. 
Therefore, we have to add them once again. 
The probability for this case is given by 

11 1 _ N -p-q + 1 
p N ~ N 



(13) 



and takes on the smallest value around 1/2 for p = 2 and q = N/2, but tends to unity 
for prime factors p k, q k, a/ZV. 

As shown in figurelH the state |^/'*^^^)yi exhibits perfect periodicity but every multiple 
of p and q has zero probability, whereas all other numbers are equally weighted. As a 
consequence, in this case the information about the factors is encoded in the "holes" . 



2.3. Analysis of periodicity 

In the preceding section, we have found that the function g = g{i, N) in its dependence 
on i exhibits periods which contain information about the factors of A^, but in some 
cases these periods are imperfect. We now analyze if it is possible to extract information 
about the periodicity of g with the help of a QFT defined by 

, 2«-l 



UQFT\i) ^ 



m=0 



exp 



mi 
2m— 
20 



|m). 



(14) 



This procedure is analogous to the Shor algorithm. We distinguish two cases for the 
state of system A. 
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Figure 4. Probability distribution P^\i;91) to find \e)A in the state IV"'^^).! for the 
example TV = 91 = 7 • 13 in the range 1 < £ < 100. The probability vanishes for all 
multiples of the factors 7 and 13. Here, periodicity even exists for multiples of TV = 91. 
The probability is equal to (A/"'^^) for all other arguments. 



2.3.1. State of A contains only multiples of p The QFT transforms the state 
given by ( ITOi) into 

2«-l r 



E 

m=0 



Nm 



;M 



N 



|m). 



with the definition 

F{a; M)=Y^ exp [2mk 



M-l 



a\ . 



(15) 



(16) 



fc=0 



As shown in Appendix A.l the sum F{pm/2^] Mp) leads to sharp peaks in the 
probabihty distribution 

2 



)(p), 



for m = rup with 



TTlr. 



m;N)= a{p\Uqft\^^p^)a 



2Q 

3— + 6j. 
p 



(17) 



These peaks will give us information about the factor p. 

Unfortunately, the sum F{Nm/2^; Mn) also leads to sharp peaks located at 
= j2'^ /N + 6j. As a consequence, we need to calculate the probability p^'^^ to 

find any nip and compare it to the probability f>^'^^ to measure any mN- 



In [Appendix A.2[ we obtain the estimates 



P^/\mp;N) > 0.4 



N -p 
Np 



(19) 
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and 



p(p) 



(m7v;iV) > 0.4- 



P 



■N(N-pr 

As a consequence, we find that peaks at nip are enhanced compared to peaks at m^r 
by the factor (A^ — p^/p^ ~ q^. This fact is clearly visible in figure Ofor the example 
= 91 = 7 ■ 13. The large frame shows the peaks located at nip. In the inset we 
magnify the probability distribution in the range 1 < m < 100. Here, also peaks at 
ruN exist. However, they are approximately 13^ times smaller. Furthermore, as verified 
Appendix A. 2 the total probability p^'^-* to find any nip tends to 0.4 whereas the 



m 



probability 'P^^ to find any approaches zero. 
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Figure 5. Probability distribution (m;91) if the measurement of system B 
resulted in the factor \7)b shown for the example ofAf = 91 = 7-13. Here, we have 
used a system of Q = 11 qbits. Clearly visible are peaks at multiples of 2^^/7 « 292.4. 
The inset at the bottom magnifies the distribution in the range 1 < rt < 100, where 
peaks at multiples of 2^^/91 « 22.5 exist. However, they are approximately 13^ times 
smaller than those at multiples of 292.4 



At last, we have to analyze the width of the probability distribution for estimating 
the minimal dimension 2'^ for an unique estimation of p from rUp. Here, we follow the 
considerations of N. D. Mermin [Tj. 

The measurement result m is within 1/2 of j ■ 2*5/p and therefore 

1 



ni 



< 



(21) 
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Does there exist another combination j' /p' ^ j/p which hes within this range of 
The distance between these two pairs of numbers can be approximated by 





_/ 




jp' _ j'p 
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1 1 
> — > — • 

pp' iv^ 



(22) 



If both combinations would he whithin 1/2**^+^ of then their distance would be 

smaller than, or equal to 1/2^ . 

Therefore, if 2*^ > A^^, then their exists only one combination j ■ 2^ jp which lies 
within 1/2 of m. For a graphical representation of this statement, we refer to figure El 
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Figure 6. Graphical demonstration of the uniqueness of j/p. The ratio j/p must be 
within l/2'3+i of m/2^ . Every other combination j' /p' with j' /p' ^ j/p must differ 
at least l/N"^ from j/p. Therefore, if N"^ < 2^ then j'/p' cannot be within l/2'3+i of 
m/2^, too. 



We conclude by emphasizing that we can extract in 40% of the measurements the 
factor p of A^. Furthermore, the imperfection of the periodicity does not influence the 
ability of the QFT to find the period p. 



2.3.2. State of A does not contain any multiples of p or q When we perform the QFT 
on the state given by f lT2|) we arrive at 



+F 



Nm 



2Q 



N 



|m). 



(23) 



where we have recalled the definition of F from ([T6 



As estimated in Appendix A. 3 , the peaks at nip and niq = j ■ 2^ /q + 5j are 
approximately q times, or p times higher than peaks at mAr. However, they are smaller 
in comparison to case (ii), where the measured value of system B was equal to p. All 
these aspects are visible in figure [3 for the example = 91 = 7 ■ 13. 
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The total probability to find any Trip or is given by 



as calculated in Appendix A. 3 This probability tends to zero for large N with two 
prime factors which are of the order of As a consequence, it is not useful to try to 
find the period of \iP^^'^)a with a QFT. 

The periodicity of \iP^^'^)a is perfect, since the states corresponding to integer 
multiples of p and q are missing. Moreover,there exist many points with the same 
value. In contrast, in the Shor algorithm, every integer i in the range < £ < r — 1 
yields |T] a different outcome of /, and therefore, we are able to find the period r with 
the help of a QFT. In our scheme there exist approximately p numbers i in the range 
< i < p — 1 which lead to the same value of g. As a consequence, it is not possible 
anymore to find the period p with the help of a QFT. Nevertheless, the state \iP^^^)a 
is remarkable, because the information about the factors of is still endcoded in the 
periodicity. Since the QFT is not a good tool to find this period, we need to develop 
another instrument which extracts the information about the periodicity of \iP^^'^)a in 
an efficient way. 



2.4- Discussion 

In this section, we have analyzed a factorization algorithm constructed in complete 
analogy to the one by Shor but with the function g given by ([2]) instead of / determined 
by dl]). Our approach combines the periodicity properties of Gauss sums with the QFT. 
Although we have found some rather encouraging results there are problems with this 
approach. Indeed, it is not possible to measure a period with the help of a QFT if there 
exists a large amount of arguments i within one period were the function assumes the 
same value. As a consequence, the problem of our scheme is not the imperfection of the 
periodicity of g but the large number of arguments i with g{i, N) = 1. 

Furthermore, we emphasize that the QFT for the case (ii) is not necessary. A 
measurement of the state \iP^p'')a, given by ( ITOl) . itself will also give us the information 
about the period p. In contrast, the Shor algorithm relies on the state 

^ M-l 

= + (25) 

^ m=0 

which contains not only the period r, but also the unknown variable io- Since it is 
not possible to extract r from an argument io + mr, the QFT is essential in the Shor 
algorithm. Furthermore, several runs of the Shor algorithm lead to different numbers io 
In summary, the modular exponentiation is not only special, because its period 
contains information about the factors of A^, but also because every value appears only 
once p] in a period. Moreover, we suspect that there may exist quantum algorithms, 
which find periods of a function in an efficient way despite the fact that nearly all 
arguments i in one period assume the same value. This may be achieved for example 
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Figure 7. Probability distribution P^\m; 91) of system A conditioned on the 
measurement of system B with the result \1)b and the QFT for the example N = 
91 = 7 • 13. Here, we have used a system of 11 qbits. Clearly visible are peaks 
at multiples of 2^^/13 sa 157.5 and 2^^/7 « 292.4. The inset magnifies the range 
1 < n < 100 where also peaks at multiples of 2^^/91 « 22.5 exist. However, they are 
approximately 13^ times smaller than the peaks at multiples of 292.4. A comparison 
with figure [5] shows that all peaks are smaller than in the case (ii). 



by a comparison of this periodic function with a function were all arguments assume 
the same value. Interferometry could archieve such a task. Here, two possibilities offer 
themselves: i) We can couple the systems A und B to an ancilla system and prepare 
the superposition by a Hadamard transform. However, in this case we are confronted 
with a probabilistic approach in the spirit of quantum state engineering [11] . ii) In order 
to avoid small probabilities for the desired measurement outcomes we rather pursue an 
idea based on adiabatic passage, a technique that has already been used successfully in 
many situations of quantum optics to synthesize quantum states [T2] . 
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3. Algorithm based on a superposition of Gauss sums 

In Sec. [2] we have discussed an algorithm inspired by the one of Shor ^ which uses the 
Gauss sum g instead of the modular exponentiation. However, we did not explain how 
to create the initial state \'^)a,b defined by (IE]). Indeed, this task is quite complicated, 
because in general it is not possible to display and add in an exact way complex numbers 
of the form e"^ with a finite amount of qbits. Therefore, we pursue in this section another 
approach where we encode g not in the states of system B but in their probability 
amplitudes. 



3.1. Central idea 

Encoding a Gauss sum in a probability amplitude of a quantum state was already done 
experimentally [3] for the truncated Gauss sum 

M 



m=0 



zTcim — 



(26) 



Moreover, the number M + 1 of terms of .4.^^^ grows only polynomial with the number 
of digits of A^, whereas for the standard Gauss sum G, defined by ([3]), it increases 
exponentially. Furthermore, we want to estimate G for several i in parallel. For this 
reason, it is not useful to realize G experimentally by a pulse train, or in a ladder system 
or by interferometry as proposed in [3]. 

On the other hand, G has two major advantages compared to .4^^^^ (i) \Gf shows 
an enhanced signal not only at arguments i = p but also at integer multiples of factors, 
and (ii) the signal at multiples of a factor is enhanced by the factor itself and not only 
by \/2. As a consequence, for the state 

N-l 

\^P)^ArJ2G{i,N)\i) (27) 

e=o 

the probability to find the state \i) with i being any multiple of a factor p is p times 
higher than finding \i k ■ p). The amount of arguments £, which are not multiples of 
p, is approximatly p times higher than the amount of multiples of p. As a consequence, 
the product of the probability of finding i = k ■ p times the amount of numbers i = k ■ p 
with 0<£<A^ — lis approximately equal to the product of the probability of finding 
i ^ k ■ p times the amount of numbers i ^ k ■ p with < i < N — 1. Therefore, the 
probability to find any multiple of a factor is around 50%. 

As a result, we have found a fast factorization algorithm provided we are able to 
prepare the state {ip) defined in fl271) in an efficient way. Unfortunately, this is not an 
easy task. On the other hand, we can use entanglement to calculate the sum 

Af-l 



■m=0 



2m irn^ h m — ' 

^ N N' 



(28) 



which is very close to the standard Gauss sum G and shows similar properties. We 
therefore now propose an algorithm based on . 
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3.2. Algorithm 

The idea of our algorithm is that system A is in a state of superposition of all trial 
factors i and the summation in m in the Gauss sum wi^^ is realized by a superposition 
of system B. Therefore, we start from the product state 

\^o)a,b = ^ E \^)a\^)b (29) 
e,m=o 

where the dimensions of the systems A and B are equal to the number N to be factored. 

Next, we produce phase factors of the form exp [27rim^£/iV] which appear in the 
Gauss sum Wil^^ by realizing the unitary transformation 



Uph = exp 



ivri Un — 



(30) 



Here, fij denotes the number operator of the system j = A,B and N defines the 
periodicity of the phase. 

The operator Uph entangles the two systems, and the state \'^i)a,b of the combined 
system is now given by 

N-1 



\^i)a,B = Uph\'^o)A,B = T? X] 



N 

e,m=o 



2711 rn^ — 

N 



\l)A\m)B. (31) 



We emphasize, that the information about the Gauss sum is not stored in a single 
system, but in the phase relations between the two systems. Therefore, tracing out 
one system and applying a number state measurement on the other, or measuring the 
number states of both systems would not help us to estimate the Gauss sums It 
would only show that all trial factors have equal weight. As a consequence, we have to 
perform local operations on the individual systems, which do not destroy the information 
inherent in the phase relations but help us to read out the Gauss sum. 

Therefore, we perform as a second step a QFT, as defined in on system B and 
the state of the complete system reads 

1 

\'^2)a,b ^ UqftUph\'^o)a,b = ^ E \^) A\n) B (32) 

n,t=0 

where 'W^\t) denotes the Gauss sum defined in f l28|) . 

This operation achieves two tasks: (i) the sum of quadratic phase terms is now 
independent of system B. For this reason, we are able to make a measurement on 
system B leaving the sum of the quadratic phase terms in tact; and (ii) in addition to 
them a second phase term which is linear in m arises. 

After a measurement on system B with outcome \nQ) b, system A is in the quantum 
state 

N-1 

l^3)A~$^>V(f(^)|^)A. (33) 
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The sum Wr!^^ is equivalent to G only for uq = 0. Nevertheless, Wn^\i) shows 
properties which are similar to but not exactly the same as G{i, N). Therefore, we have 
to investigate now the influence of hq on Wn^^ 

3.3. Probability distribution of system A 

In this section, we discuss the probability distribution 

Pi-)(£,iV)=ArM|>V(f(^)P (34) 

of system A, provided the measurement result of system B is equal to no, and analyze its 
factorization properties. Here, denotes a normalization constant. Furthermore, we 
investigate how the measurement outcome uq of system B influences these properties. 



From [Appendix B| we recall the result 

r ^ if gcd(£,Ar) = l 
\^S\^)\'=< § ifgcd(£,Ar)=p&gcd(no,p)=p , (35) 
I if gcd(£, A^) = p & gcd(no,p) 7^ p 

and recognize that there is a distinct difference between trial factors i which share a 
common divisor with and trial factors which do not. Depending on whether nQ is (i) 
equal to zero, (ii) shares a common factor p with A^, or (iii) shares no common divisor 
with A^, the probability for factors and their multiples is much higher than for other 
trial factors, or equal to zero. In any case, it is possible to distinguish between factors 
and nonfactors. 

Now, we investigate the abilities of these three classes of probability distributions 
to factor the number A^. 

3.3.1. uq is equal to zero A special case occurs for no = where the probability 
distribution P^\i, N) is equal to the absolute value squared of the Gauss sum G{i, N). 
It is the only case, where the probability P^J^°\i = 0,N) is nonzero. Indeed, here it 
is A^ times larger than for trial factors, which do not share a common divisor with A^. 
However, also in this case the probability to find a multiple of any factor p of A^ is p 
times larger compared to arguments which do not share a common factor with A^. It is 
for this reason that the multiples of the factors p = 7 and 13 stand out in figure [H 

Important for the present discussion is not the probability for a given i itself, but 
the probability to find any multiple of a factor. Now, we assume that A^ contains 
only the two prime factors p and q = N/p. In this case, there exist N/p — 1 multiples 
of the factor p with the probability p/ {4N — 2p~ 2N/p + 1) and p — 1 multiples of the 
factor q = N/p with the probability {N/p) /{AN — 2p — 2N/p + 1). Therefore, V^'' is 
given by 

p(o) ^ 2N-P-N/P 

^ 2{2N -p-N/p) + l ^ ^ 
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Figure 8. Factorization ofA^ — 91 = 7-13 with the help of the probability 
distribution P^\£] 91)to find the state \£)a in system A if we have measured before the 
state |no = 0)b in system B. This probability distribution is proportional to |Wo^"'^''P- 
The probability for ^ = is = 91 times larger than for trial factors which do not 
share a common divisor with N. For arguments £ which are multiples of a factor p — 7 
or 13 the probability is p = 7 or 13 times larger, respectively. 



For large integers N we can neglect the term +1 in the denominator and arrive at the 
asymptotic behavior 

W I- (37) 

As a consequence, the probability to find any multiple of a factor tends for large 
to 1/2 independent of the prime factors. Therefore, the probability distribution 
P^^ {£, N) is an excellent tool for factoring. 

3.3.2. no and N share a common divisor p If hq is a multiple of p with N = p ■ q 
the probability to find i = k ■ p is p times larger than for other trial factors £. But 
the probability to measure a multiple of q is equal to zero. This fact is clearly visible 
in figure [9] where we factor the number = 91 = 7 ■ 13 with the help of P^'^\i, 91). 
Because no = 14 shares the common factor 7 with A^ = 91, all multiples of 7 have a 
probability that is 7 times larger than arguments which do not share a common factor. 
In contrast, the probability to obtain any multiple of 13 is still zero. 

In order to derive the probability 'P^'^^ to find any multiple of a factor we note that 
there exist N/p — 1 multiples of the factor p with probability p/{2N — 2p — N/p + 1) 
and arrive at 

^ 2{N -p)- N/p + 1 ^ ' 

This function is monotonically decreasing for 2 < p < N/2. Therefore, we get the 
smallest probability for the largest possible prime factor of A^, which is N/2 and leads 
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Figure 9. Factorization ofA^ = 91 = 7-13 with the help of the probability 
distribution P^'^\£;91) to find the state \£)a in the system A if we have measured 
before the state |no = 14)b. This probability is proportional to |w}4^''P- For £ being 
a multiple of 7 the probability is seven times larger than for other trial factors, but 
for the multiples of the factor 13, the probability vanishes, because hq — 14 is not a 
multiple of 13. 



to 

mm (Va ] = — > 39 

which for large also tends to 1/2. 

As a consequence, the case no = k ■ p displays a similar behavior as no = 0: The 
probability {i, N) is also an excellent tool for factoring. 

3. 3. 3. no and N do not share a common divisor As shown in Fig. [TD] the probability 
p(jio¥^kp) ^ multiple of a factor is equal to zero if uo and do not share a 

common divisor. As a consequence, it is not possible to deduce the factors of A^ with a 
few measurements of the state of system A. Nevertheless, it should still be possible to 
extract the factors of A^ from p^'^^'^'P') ^ although at the moment we do not know how 
to perform this task in an efficient way. However, there exist proposals that encoding 
information in the zeros of a function is better than encoding them in the maxima. 
Therefore, we suspect that there may exist an algorithm to obtain the information about 
the factors of A^ from the zeros of P^°^'''^\i, N). 

3.4- Probability distribution of system B 

In the preceding section we have found that the probability distribution of system A 
depends crucially on the measurement outcome uq of system B. Depending on whether 
no is a multiple of a factor of A^ or not, system A shows a different behavior. Therefore, 
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Figure 10. Factorization of — 91 — 7-13 with the help of the probabihty 
distribution P^\£;91) to find \£)a in system A if we have measured before the state 
I'^o = 4)3- The probabihty is proportional to |yV4^"'^''p. Clearly visible are the zeros 
when ^ is a multiple of a factor such as p = 7 or 13. All other trial factors i are equally 
probable. 



it is essential to investigate the probability distribution of system B for predicting the 
behavior of system A which constitutes the topic of the present section. 

With the help of the quantum state fl32l) of the combined system the probability 
distribution 



N-l 



l{i\B{n\\'^2)A,B\ 



PB{n,N) = 
for system B is given by 

PB{n,N) = ^'j2H''\^)f- 



(40) 



(41) 



i=0 



From the explicit expression ( 135|) for 
1 



PB{n,N) 



1 

N 



N 



we obtain the result 
P 



n,N),; 



+ ^(P 



gcd(n,N),q 



if is the product of the two prime numbers p and q. 

An example for such a probability is depicted in figure [HI where we show PbI^, N) 
for the example A^ = 91 = 7-13. The probability to find a multiple of the two factors 
7 and 13 is larger than for other trial factors. 

However, we are not interested in the probability of a single n, but rather in the 
probability °^ ''^ °^ '"^^ that hq is equal to zero, or a multiple of a factor, because in 
these two cases it is possible to efficiently extract the information about the factors of 
N. Since -pi^ ''■p ''■1) 

is given by the sum over all probabilities Psi^, N) where n falls 
into one of these cases that is 



V 



(0 or k-p or k-q) 
B 



= Pb{0, N) + {q- 1) Pb{p, N) + {p- 1) Psiq, N) 



(43) 
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Figure 11. Probability 91) for system B to be in the state \n)B for tlie example 

= 91 = 7 • 13. For n = the probability is largest. For multiples of a factor the 
probability is enhanced compared to other trial factors. 



we find with the help of (H2|) and q = N/p the expression 

'B Np p m N m N N^' ^ ' 

The probability °^ '''^ °^ exhibits a minimum a,t p = y/N, where it is given by 

4Ar3/2 + 47V1/2 _ - 1 ^ 
"^i^ (^Af) = (45) 



and it tends to zero for large as the inverse of a square root. As a consequence, 
it is very unlikely that Uq is equal to zero, or a multiple of a factor but it is highly 
probable that uq shares no common divisor with A^. Unfortunately, in this case a rapid 
factorization based on our algorithm is only possible if we find an efficient way to extract 

,(ra 

A 



the factors of A^ from p^"-'^^^'^^ 



3. 5. Degree of entanglement 

In Sec J3.2l we have mentioned that the information about factors is contained in the 
entanglement of the two systems A and B. Indeed, f l35|) suggests a strong correlation 
between the two systems. We now investigate the degree of entanglement p^H^ with 
the help of the purity 

= Tr, {p}) (46) 

of the reduced density operator pi with i = A,B. For a product state the purity is equal 
to unity. On the other hand, the state is maximally entangled if p = 1/D, where D 
denotes the dimension of the subsystem. We now derive an exact closed-form expression 
for p. 
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The reduced density operator pA of system A after the unitary transformation Uph 
following from (l30l) reads 

N-l N-1 



PA 



■^2 E E^^p 



2mm 



N 



(47) 



e,i'=0 m=0 

which is independent of applying a QFT on system B or not. As a consequence, the 
purity 

N-l N-1 

' 2 



^,A:=Om,m'=0 

of subsystem A can be reduced to 

N-l 



A; 



iV 



(4J 



1 ^-1 



ATS 



^exp 



m=0 



27rim 



AT 



and is given by the sum 

N-l 



(49) 



(50) 



1=0 



of the standard Gauss sum G{i, N) over all test factors £. Assuming that A^ only contains 
the two prime factors p and q = N/p, the purity can be written in a closed form which 
results from the following considerations. 

For i = the standard Gauss sum is given by \G{£ = 0,A^)p = N^. Furthermore 
there exist N/p — 1 multiples of p which leads to the standard Gauss sum \G{i = 
k-p,N)\'^ =pN and p-1 multiples of N/p with \G{i = k ■ N/p, N)\'^ = N'^/p. For all 
other trial factors i, there exist N — p — N/p + 1 of them, the standard Gauss sum is 
given by |G(£)p = A^. Therefore, the closed form of the purity reads 



^=A^ 



.N 



N^ 



N^ + pN{ 1) + — (p-1) +A^(A^ 



p 



p 



P- — + 1) 
P 



that is 



AN -2p- 2N/p + 1 

iV2 ■ 



(51) 



(52) 



The purity is maximal for p = yN and tends in this case for large A^ to 4/A^. The 
maximal value of purity is equal to the minimal degree of entanglement. Since the 
maximal purity is only 4/A^ and therefore very small, the two systems A and B are 
strongly entangled. 



3.6. Realization with qbits 

So far, we have not discussed the resources and the time necessary for our proposed 
algorithm. Both of them depend strongly on the underlying physical systems. For 
example, we can use two light modes for the two systems A and B and the most 
appropriate states are photon number states. As a consequence, the energy needed to 
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display all states and \m)B would grow exponentially with the number of digits of 
N. 

Therefore, it is more efficient to run the algorithm with qbits. Here, the number 
Q of qbits scales linearly with the digits of N. However, the use of qbits changes our 
algorithm a little bit. For example, the initial state |\I/o)a,b given by (|29l) now reads 



m,e=o 



with iV^ < 2*^, that is the dimension of the system is not anymore given by the number 
to be factored. Moreover, this state can be easily prepared by applying a Hadamard- 
gate to each single qbit whereas the state |^o)a,b is hard to create. 

In the unitary phase operator Uph defined in ( 130|) the number N to be factored is 
encoded in an external variable which is independent of the dimension of the system, 
and can therefore be chosen arbitrarily. However, the QFT works now on a system of 
the size 2*^ and therefore the final state 



\'^2)a,B — UqetUpkI^'q) A,B 

before the measurement on system B is given by 



where we have introduced 

Hl^)(£,M)^i-|^exp 



M-l 



m=0 



27ri (m^ 



+ m 



Hi.- 
M' 



(54) 



(55) 



(56) 



We emphasize that this Gauss sum is a generalization of the Gauss sum defined 
by fl28l) due to the different denominators in the quadratic and linear phase. For reasons 
we have denoted this Gauss sum VVn^^ {i, M) includes two arguments. 
For the investigation of VVn^^ , we rewrite the summation index 

sN + k 



m 



multiple s of plus k and find 

Mjv-l 



27ris- 



W!r\i,2<^) = ^ E exp 

s=0 

The remainder 

1 ""^ 
^(^) = ^5Z^^P 



Nn 



N-l 



^exp 



k=0 



n 



2m ( k^— + k ^ 
N 2Q 



+ R{1). 



k=0 



2m 



k^£+k- n 
N 



(57) 



(5^ 



(59) 



with MN + r = 2'^ consists of less than terms, whereas the other part contains almost 
A^^ terms. As a consequence, we neglect R and the probability P^{n,N) to measure n 
in system B is approximately given by 



PUn,N) 



23Q 



N-l 



^exp 



k=0 



2m 



n 



P— + k ^ 
N 2Q 



F 



f nN 



\ 2Q 



M, 



N 



(60) 
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where we have recalled the definition of F (nN/2'^; M^v) from fll6p . 

According to Appendix A.l the function F M^-) is sharply peaked in the 

neighborhood of 

2Q 



(61) 



with \5j\ < 1/2 if A^^ < 2^. This behavior is depicted in figure [T2] for the example 
iV = 21 and g = 9. 



Since according to Appendix A.l| the sum F can be approximated by 

2 



Fi^^-M^j ^exp[7ri5,] -M^ 
we can estimate the probability 



(62) 
(63) 



"AT 



to find any tin defined by ( l6Ti) by 



B 



4 22Q 1 
^ m 23Q 



that is 



EE 

1=0 j=0 
2<3-l AT-l 



N-1 

E 

k=0 



exp 



27ri k 



N N 



TT 



2 2Q 



(64) 



(65) 



By using (1351) we find 

TV-l 

E i<' 



(66) 



i=o 



by the following considerations: if gcd(£, A^) = 1 then |>Vj (i')P = 1/A^ for all j and 



p/N only for j = k ■ p and zero 



(!66|) follows at once; if gcd(£,Ar) =pthen |>Vj 
for all other j. Since in this case we have q such terms we again obtain ( I66ll . 
As a consequence of f l66|) . the probability V'^ given by fl65|) reduces to 



4 1 
^2Q 



TT 



El 



(67) 



and system A is with a probability greater than 40% in the state 



(68) 



£=0 



which is similar to the state \4'3)a given by ( 133|1 obtained by the algorithm described 
in Sec J3.2[ However, it differs from it by the upper limit and by the fact that now the 
measurement outcome of system B is not uq but the multiple j of 2^ /N defined by ( |6T]l . 
Nevertheless, the properties of the states necessary to factor A^ are the same. 



Factorization with Gauss sums: Entanglement 

0.15Fi 



22 



CM 

fi 0.1 



0.05 



24.4 



49.! 



n 



74.1 



98.5 



Figure 12. Probability P'si^] 21) for system B to be in the state \n)B for the example 
21 = 7 • 3 employing Q — % qbits for the algorithm. The probability is sharply 
peaked at muhiples of 2'3/iV « 24.4. 



3.7. Discussion 

The analysis presented in this section was motivated by the idea to replace in the Shor 
algorithm the modular exponentiation by the standard Gauss sum. Indeed, the approach 
of Secl2] has lead us to the problem how to prepare the initial state containing the 
standard Gauss sum which we could solve in the present section by encoding the Gauss 
sum yVn^\i) into the probability amplitudes. However, this technique suffers again 
from the desease, that we arrive at a state, where the factors of N are encoded in the 
absence of certain states. As a consequence, the search for an algorithm, which detects 
in an efficient way the periodic appearance of missing states is the most important task 
for the future of factorization with Gauss sums. 

Moreover, we emphasize that by encoding the Gauss sum in the probability 
amplitudes we did not use the periodicity of the function itself, which was important in 
the Shor algorithm. The feature of the Gauss sum central to an effective factorization 
scheme is the fact that although there exist many more integers i which are useless in 
factoring the number A^, the product of their amount times their probability is nearly 
equal to the amount of integers which do help us times their probability. This is the 
important difference to the truncated Gauss sum A^^^\ Here, the ratio between the 
probability of factors to non-factors can be as small as 1 : l/\/2. Furthermore, the 
truncated Gauss sum only exhibits maxima for the factors themselves and not for their 
multiples. 

4. Summary 

So far the major drawback of Gauss sum factorization has been its lack of speed. 
Therefore, we have combined in the present paper the Shor algorithm with the 
factorization with Gauss sums. Here, we have used the features of the absolute value 
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\G{i,N)\'^ of the standard Gauss sum. Since G shows similar periodic properties as 
the function f{i, N) = mod which plays an important role in the Shor algorithm, 
we have replaced / by g{i,N) = \G{i,N)\'^/N and have investigated the resulting 
algorithm. We have shown that / is not only special because it is a periodic function, 
but also because there does not exist two arguments within one period which exhibit 
the same value of the function. This feature is the main difference to g, where nearly 
all arguments within one period lead to the same functional value. Therefore, we face 
the problem, that we have to distill the period of g out of the zeros of a probability 
distribution instead of its maxima. Furthermore, by replacing f hj g the QFT is not 
necessary anymore. 

Another challenge of our combination of Shor with Gauss sums, is the creation of 
the initial state \'^)a,b defined by (IE]) because g consists of a sum of complex numbers 
instead of integers. We have circumvented this problem by encoding the closely related 
Gauss sum Wi^'' in the probability amplitudes instead of the state. Furthermore, the 
number of terms in the standard Gauss sum grows exponentially with the number of 
digits of A^ which makes it necessary to develop implementation strategies different from 
the ones which had been sucessful |1] with the truncated Gauss sum. Therefore, we have 
shown how to realize the Gauss sum Wn^'' with the help of entanglement in an efficient 
way. Unfortunately, the resulting algorithm also sufferes from the problem that we need 
an efficient method to extract information from the zeros of a probability distribution. 

In summary, we have investigated the similarities and differences of the Shor 
algorithm compared to Gauss sum factorization, which has lead us to a deeper 
understanding of both algorithms. Although, we have outlined a possibility for a fast 
Gauss sum factorization algorithm there is still the problem of the information being 
encoded in the zeros of the probability. As a consequence, the next challenge is to find 
an algorithm which performs this task and paves the way for an efficient algorithm of 
Gauss sum factorization. 
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Appendix A. Probabilities for the Shor algorithm with Gauss sums 

In the present appendix we first derive an approximation for the sum 



M-l 




(A.l) 



k=0 
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at arguments a close to an integer j, that is a = j + Sj/M with the upper bound M and 
\6j\ < 1/2. We then apply this approximate expression to calculate the probabilities 

A '^^'■^ ' A 



v'f'^^ and p^^'^^ discussed in Sec. El 



Appendix A. 1. Approximate expression for F {a; M) 
We establish with the help of the geometric sum 

a closed form expression of F which reads 

^/ , 1 — exp [27riQ;Ml , 

F a; M = A.3 

^ ' ^ l-exp[27ria] ^ ^ 

By factoring out the phase factor exp [ivraM] in the numerator and exp [ivra] in the 
denominator we are able to rewrite (1A.3P as 



F{a; M) = exp i7ra(M - 1) ^ — (A.4) 

sin (vro;) 

which is a ratio of two sine functions. This function displays maxima at integer 
arguments a = j. For a = j + Sj/M we arrive at 

F{j + 6j/M; M) ^ exp[i7r5,] ^l^^^!^^. (A.5) 



sm I vr-^ 



Here, we have made use of the approximation (M — 1)/M ^ 1 and the fact, that 
sin(7r(A; + x)) = (—1)'^ sin(7ra;) and exp[i7r/c] = (—1)'^ for integer k and that for odd j one 
of the two expressions jM and j{M — 1) is even. 

The argument x = irSj of the sine function in the numerator lies in the regime 
< X < 7r/2 and can therefore be approximated by 

25 j < sin {Tr5j) (A. 6) 

as we demonstrate graphically in figure lAll 

Furthermore, the sine function in the denominator of (1A.5I) can be approximated 
by sin (vr^j/M) ^ nSj/M because its argument x = 7i6j/M is much smaller than unity. 
Hence, we obtain 

F{j + 6j/M- M) > exp[in6i] -M (A.7) 
as the final result. 

Appendix A. 2. Calculation of probabilities V^'^^ andV^'^^ 

To estimate the probabilities V^'^^ and 'P^'^'' to find any multiple of 2^/p or of 2^ /N, 
if a measurement of system B resulted in the factor p, we have to investigate the 
probability distribution 
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Figure Al. Graphical demonstration of the inequahty 2x/tt < s'mx for < a; < 7r/2. 
Here, the solid line depicts the function sinx whereas the dashed line represents 
fix) = 2x/n. 



for mp = j- + 6j and = j ■ + 5j, with Mn = [2Q/N] and Mp = [2«/p]. 

We first discuss the situation for rup and evaluate the function F at the arguments 



20 ' ^20 ' Mp 



and 



using the estimate flA.Tp 

F{j + 6j/M; M) > exp[i7T6A -M (A. 11) 

TT 

for \5j < 1/2|. 

As a consequence, the probabihty to find a state |m) with m being close to a 
multiple j of 2'^/p reads 

Pa\^p; N) > ^Q^Mp-M^) V- + " 2^^^^) ^^-^^^ 
which reduces with the help of the binomial formula + — 2xy = [x — yY io 

frb-.:m>!%^^,- (A.13) 

When we recall that Mjy ~ 2^^ /N and Mp ^ 2'5/p we obtain the final result 

P^\mp-N)>OA^ (A.14) 
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with the approximation A/tt"^ > 0.4. 

Since there exist p different values of nip the total probability P^'^^ to find any 
multiple of 2^^ /p is given by 

pfep) > 0.4^^^ (A.15) 



which tends towards 0.4 for large and prime factors p < yN. 

We now calculate the probability P^\mN; N) to find m^r = j ■ 2^^ /N + 6j which 
are not multiple of rup. At these arguments the sum F (pmj^/2^; Mp) is close to zero 
and therefore can be neglected. As a consequence, we can approximate P^\mN', N) by 

P?'(.n.;iV)>0.4 ^,^^<^^^^ .0.4^^. (A,16) 

Since there exist N — p different values of m^v the total probability p^'^^ to find any 
multiple of 2'^ /N is given by 

pfe^) > 0.4^ (A.17) 



which tends towards zero for large A^ and prime factors p < y N . 
Appendix A. 3. Calculation of probability P^^ 

Similar to the calculation in the last section, we now evaluate the probability P^^ to 
find any multiple p or g if the measurement of system B resulted in unity. For this task, 
we first estimate the probability distribution 



1 



20' J \2Q 

(A.18) 



2Q{29 - Mp - Mg + Mjv 

for nip = j ■ 2^ /p + 6j, nig = j ■ 2'^/q + 6j and m^v = j ■ 2^/N + 6j following from 
with Mg = [2<3/g]. 

The first term given by F is equal to zero for all m ^ 0. The second term leads 
to peaks at multiples of 2'^ /N, the third to peaks at multiples of 2'^ /p and the last to 
peaks at multiples of 2'^/q. In this case, we get information about the factors of A^ only 
from the peaks at multiples of 2'^/p and 2'^/q. 

As a result we obtain the probability 

P«K; N) > 0.4 J^L~^ff ^ (A.19) 
^ ^ ^' ^ 2Q{2Q - Mp- Mq + Mn) 

to find rUp. Here, we have taken into account that m j ■ 2*^/p is also an integer 
multiple of 2^ /N. With the help of the approximations Mn ~ 2'^/N, Mp ^ 2'^/p and 
Mq ^ 2^ jq we get the final result 

^"K^^)>°- V(;v'!;-p+l) - t^-^") 
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Similar, we obtain 

(m„ TV) > 0.4 2Q^2Q - M, - M, + Mr,) '^'^ N{N-q-p + 1) ^^'^^^ 

for the probability to find m ^ j ■ 2'^/q. 

For P^\mN, N) only the term F Mj^^ is non- vanishing which leads to 

pW(m.; N) > 0.4 _ Jf^^^^ ^ ^^^^ ^ 0.4 „^^_'^_^^^y (A.22) 

As a consequence, we arrive at the total probability 

°' " = PP'IW, N) + ,P<"(,„„; TV) > 0.4^!^i±^Ptlt^ (A.23) 
to find any multiple of a factor p or g. 



Appendix B. Probabilities for the superposition algorithm 

In this appendix, we calculate the probability 

Pi-)(£,Ar)=ArK)|W(f(£)p (B.l) 

to measure i in system A if the measurement result of system B was uq. Here, A/" is a 
normalization constant and Wn^^ is defined as 



no 
N-l 



Wf^W^^J^exp 



m=0 



2711 (m h m — 



N 



N' 



(B.2) 



Since P4"'''^(£, A^) is proportional to W we take advantage of the result 



(B.3) 



from Ref. [15]. Here, A^ is odd and i does not share a common divisor with A^. We are 
only interested in factoring odd numbers A^. If we have to factor an even number, we 
can divide it by two repeatedly until we arrive at an odd number. 

If i and A^ share a common divisor p we have to eliminate it before we are allowed 
to apply (IB. 31) . Assuming that 

i = k-p, N = q-p (B.4) 

with k and q coprime, the sum Wn^^ reduces to 



W(7)(fc-p)^l5^exp 



m=0 



,k 



2711 [m — h 



(B.5) 



Now, the quadratic phase is periodic with period q and not with period A^. Therefore, 
it is useful to rewrite the summation index m as 



m 



r ■ q + s 



(B.6) 
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and cast the Gauss sum 

T- = s = 

into the form of a product of two sums, where 

p-i 

FiriQ.p) = ^exp 



r=0 



/vri — r 



^K,p)-WSnA:)(B.7) 



(B.8) 



points out the role of hq: it is equal to p if it is a multiple of p. Otherwise, it vanishes. 
We now apply (1B.3P to evaluate |Wno''(fc)| and find 



^ ifgcd(£,iV) 



if gcd(£, A^) = p&gcd(no, p) = p 
if gcd(^, N) = p Sz gcd(no,p) 7^ p 



(B.9) 



We emphasize that here we define gcd(0, A^) = A^. 

The normalization constant Af follows from the condition 

N-l 



(B.IO) 



and reads 



N 


4N-2p- 


2q+l 


N 




2N-2p~ 


-q+1 


N 





for no = 
for gcd(?2o, 
else 



(B.ii; 



N-p-q+l 

assuming contains only the two prime factors p and q. 
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